Hacker News Reader

Yes, I believe so.

Definition of sensitive data: https://www.legislation.gov.uk/ukpga/1998/29/section/2

Some legal restrictions on processing said data: https://www.legislation.gov.uk/ukpga/1998/29/part/II

However, it's not clear to me to what degree, if any, security agencies are exempt from the Data Protection Act.

There's a sweeping exemption from the DPA for the purposes of "national security". Any minister can issue a certificate stating that a given activity is for the purposes of national security and therefore exempt & these certificates can be issued retrospectively.

It's all laid out in section 28 of the DPA: https://www.legislation.gov.uk/ukpga/1998/29/section/28

I wonder if their industry partners are similarly indemnified...

but there are also protections e.g. if they come across evidence of stuff that is not related to national security it is ignored.

Reply on news.ycombinator.com